CVE-2026-64079 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: allocate hook ops while under mutex
arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL.
If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference:
general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net
Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error.
audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding.
Based on earlier patch by Tristan Madani.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within the Linux kernel's netfilter subsystem, specifically in the x_tables implementation that manages packet filtering tables for both ipv4 and ipv6 protocols. The issue stems from a race condition during table registration where the system allocates memory for hook operations after adding the table to the per-network namespace list, creating a temporal window where the table appears in the list but has NULL operations pointers. This flaw manifests when concurrent execution paths attempt to process table cleanup while the registration is still in progress. The vulnerability is classified under CWE-362, representing a race condition that can lead to memory corruption and system instability.
The technical implementation flaw occurs in the arp/ip(6)t_register_table() function where the sequence of operations creates an unsafe state. The function first adds the table to the per-netns list through xt_register_table() before allocating per-netns hook operations via kmemdup_array(). This ordering allows a concurrent pre_exit callback to find the table during its registration phase and pass a NULL ops pointer to nf_unregister_net_hooks(), resulting in a general protection fault. The kernel's network filter subsystem operates under strict synchronization requirements where such race conditions can lead to complete system crashes or privilege escalation exploits.
The operational impact of this vulnerability is severe as it can cause system panics and denial of service conditions when network namespace cleanup occurs concurrently with table registration. Attackers could potentially exploit this timing window to trigger NULL pointer dereferences that result in kernel oops messages, system crashes, and ultimately complete system instability. The vulnerability affects all systems running Linux kernels with netfilter support, particularly those implementing dynamic network namespace management or frequent table registration/unregistration operations. This weakness directly aligns with ATT&CK technique T1059.006 for system compromise through kernel-level exploitation.
The fix implemented addresses the core race condition by moving the ops allocation into the xtables core functionality, ensuring that tables are never added to the list without valid operations pointers. The solution also incorporates proper synchronization mechanisms including synchronize_rcu() calls during error unwinding to ensure no packets are processed with incomplete table structures. Additionally, audit log registration is deferred until all operations complete successfully, preventing inconsistent logging states during error recovery scenarios. This approach follows established security patterns for concurrent access control and resource management in kernel space. The patch was developed based on earlier work by Tristan Madani and represents a robust solution that maintains backward compatibility while eliminating the race condition through proper ordering of critical sections.